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Amendments to the Specification; 

Please replace the paragraph beginning at page 2, line 1, with the following rewritten 
paragraph: 

Nevertheless, understanding of fF -Information Technology (YT) service 
delivery has improved. Initially, only isolated measurements of infrastructure 
components, such as servers, hubs and routers, were available. Incrementally, 
component measurement methods have increased in sophistication, and in general 
meet the reporting and diagnostic requirements of their respective support groups. 

Please replace the paragraph beginning at page 3, line 1, with the following rewritten 
paragraph: 

Global corporations are becoming ever more dependent upon a continuously 
available, well behaved suite of applications which underli e e^commcrce electronic 
commerce re-commerceV Existing management systems can look backward to show 
what has happened, or look at the real-time environment, to show what is happening 
now. The new management capability required will need to examine selected 
information from multiple sources and vantage points, perform the necessary analyses 
and, based on these indicators and in conjunction with historical data, predict (in 
probabilistic terms) when the system is likely to experience performance degradation. 
Prediction is a new key capability, for it provides time to react and in the best case 
avoid any user-visible impact. 

Please replace the paragraph beginning at page 5, line 9, with the following rewritten 
paragraph: 
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U.S. Patent No. 6,574,149 "Network monitoring device" to Kanamaru et al 
describes a system that contains nodes that send packets of information to 
neighbouring n eighboring n odes so as to detect whether some nodes have broken 
away from the system. Here the emphasis is mostly on integrity of the network, not 
on performance. U.S. Patent No. 6,470,385 "Network monitoring system, monitored 
controller and monitoring controller" to Nakashima et al. describes a system in which 
network devices are cormected to a plurality of monitoring stations. This point to 
multi-point connection passes through a broadcast unit that serves as a branching 
point of multiple coimections and is responsible for transmitting information on status 
of individual stations toward a plurality of monitoring stations in the system. No 
probing or predictive statistical modeling is used. U.S. Patent No. 6,560,61 1 "Method, 
apparatus and article of manufacture for a network monitoring system" to Nine et al. 
describes a system in which tasks are being sent to various nodes in the network to 
establish whether a problem exists and automatically opening a service ticket against 
a node with a problem. This system does not use the internal information related to 
operation of nodes and does not involve predictive modeling. U.S. Patent No. 
6,055,493 "Performance measurement and service quality monitoring system and 
process for an information system" to Ries et al. discusses a monitoring system that is 
based on reports that are issued periodically based in indicators obtained via the 
proposed process of data homogenization. There is no active probing - instead the 
proposed system uses polling that retrieves status information from network nodes. 
There is no predictive modeling or automated signal triggering mechanism. 

Please replace the paragraph beginning at page 9, line 5, with the following rewritten 
paragraph: 

The modeling problem can be formulated as follows. One is interested in 
predicting what the transaction time will be at some time in the future. The time 
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between the present time and this time in the future will be called the "prediction 
horizon." Determination of a suitable prediction horizon depends on a trade-off 
between (a) the ability to take timely corrective actions in response to an alarm and 
(b) prediction accuracy for the selected prediction horizon. The longer the prediction 
horizon, the more time will be available to respond with effective corrective action 
but the larger will be the percentage of false alarms, i.e. the "corrective" action is 
unnecessary. It is therefore important to have enough time to take corrective action 
before the problem becomes evident to the user, but not so much time that the 
network is burdened with unnecessary corrective measures. For example, one could 
choose a prediction horizon to be the minimal time period for which the alarm is 
practically useful, and then determine what is the corresponding rate of false alarms. 
Alternatively, one could determine an acceptable rate of false alarms, and then 
determine whether the corresponding prediction horizon is practically useful. In 
either case the methodology of the invention allows determination of a suitable 
balance between prediction horizon and false alarm rate by trial and error. 

Please replace the paragraph beginning at page 21, line 9, with the following rewritten 
paragraph: 

We use a regression tree fitting procedure named CART (Classification and 
Regression Trees), as described in L. Breiman et al. Classification and Regression 
Trees, Wadsworth International Group, Belmont CA (1984) to fit the regression tree 
to the . We control the growth of the tree by pruning it to have a prespecified 

number of leaves. Typically, we would like to have a tree of diameter no more than 
three to limit us to three-way interaction terms. The variables that define the path to 
the leaf are then fitted as an interaction term in the AM. It has also sometimes 
advantages to consider only two-way interactions even with trees of diameter three. 
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In this case one can restrict the backfittine b ack fitting a lgorithm to using only the 
temis in the corresponding branch of the tree from the root. We also mention that in 
addition to this method, Multivariate Adaptive Regression Splines (MARS) method 
(as described in J, H. Friedman, "Multivariate Adaptive Regression Splines" in 
Annals of Statistics, 1991, vol. 19, beginning at page 1) has proven useful in detecting 
interactions. 



